Secret Key and Private Key Constructions for 
Simple Multiterminal Source Models 
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Abstract — This work is motivated by recent results of Csiszar 
and Narayan (IEEE Trans, on Inform. Theory, Dec. 2004), which 
highlight innate connections between secrecy generation by 
multiple terminals and multiterminal Slepian-Wolf near-lossless 
data compression (sans secrecy restrictions). We propose a new 
approach for constructing secret and private keys based on the 
long-known Slepian-Wolf code for sources connected by a virtual 
additive noise channel, due to Wyner (IEEE Trans, on Inform. 
Theory, Jan. 1974). Explicit procedures for such constructions, 
and their substantiation, are provided. 

I. Introduction 

The problem of secret key generation by multiple termi- 
nals, based on their observations of distinct correlated signals 
followed by public communication among themselves, has 
been investigated by several authors ([9], [1], among others). 
It has been shown that these terminals can generate com- 
mon randomness which is kept secret from an eavesdropper 
privy to the public interterminal communication. Of particular 
relevance to us are recent results in [5] for models with 
an arbitrary number of terminals, each of which observes a 
distinct component of a discrete memoryless multiple source 
(DMMS). Unrestricted public communication is allowed be- 
tween these terminals. All the transmissions are observed 
by all the terminals and by the eavesdropper. Two models 
considered in [5] are directly relevant to our work, and these 
are first briefly described below. 

(i) Suppose that d > 2 terminals observe n i.i.d. repeti- 
tions of the random variables (rvs) X\, ■ ■ ■ Xg, denoted by 
Xi , • ■ • , Xrf, respectively. A secret key (SK) generated by 
these terminals consists of "common randomness," based on 
public interterminal communication, which is concealed from 
an eavesdropper with access to this communication. The 
largest (entropy) rate of such a SK is termed the SK-capacity, 
denoted by Csk, and is shown in [5] to equal 
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with 



n 



■ Rd) ■ ^ Ri > 



H({X 3 , j e B}\{Xj, 3 €B c }),Bc{l,---,d}}, 
where B c = {I, ■ ■ ■ , d}\B. 

(ii) For a given subset A C {1, • • • , d}, a private key (PK) 
for the terminals in A, private from the terminals in A c , is a 
SK generated by the terminals in A (with the possible help of 
the terminals in A c ), which is concealed from an eavesdropper 
with access to the public interterminal communication and also 
from the "helper" terminals in A c (and, hence, private). The 
largest (entropy) rate of such a PK is termed the PK-capacity, 
denoted by Cpk{A). It is shown in [5] that 

C PK {A) = H({Xi, i e AjUX,, i e A c })-R min (A), (2) 



where 



with 



R mm (A) = min V^i, 



min y Ri , 



TZ(A) = {{R,iEA}:J2^> 

H({X j} j e B}\{Xj, j e B c }),Bc A}. 

The results above afford the following interpretation. The 
SK-capacity Csk, i-e-, largest rate at which all the d terminals 
can generate a SK, is obtained by subtracting from the maxi- 
mum rate of shared common randomness achievable by these 
terminals, viz. H(X\, ■ ■ ■ , Xg), the smallest sum-rate R m in 
of the data-compressed interterminal communication which 
enables each of the terminals to acquire this maximal common 
randomness. A similar interpretation holds for the PK-capacity 
Cpk(A) as well, with the difference that the terminals in A c , 
which act as helpers but must not be privy to the secrecy 
generated, can simply "reveal" their observations. Hence, the 
entropy terms in Q are now replaced in (|2} with additional 
conditioning on {Xi, i € A c }. It should be noted that R m in 
and Rmin(A) are obtained as solutions to Slepian-Wolf (SW) 
multiterminal near-lossless data compression problems not 
involving any secrecy constraints. This characterization of the 



SK-capacity and PK-capacity in terms of the decompositions 
above also mirrors the consecutive stages in the random coding 
arguments used in establishing these results. For instance, 
and loosely speaking, to generate a SK, the d terminals first 
generate common randomness (without any secrecy restric- 
tions), say a rv L of entropy rate ^H(L) > 0, through SW- 
compressed interterminal communication F. This means that 
all the d terminals acquire the rv L with probability = 1. The 
next step entails an extraction from L of a SK K = g(L) of 
entropy rate —H (L\Y), by means of a suitable operation per- 
formed identically at each terminal on the acquired common 
randomness L. When the common randomness first acquired 
by the d terminals is maximal, i.e., L — (Xi, • ■ • , X<j) with 
probability = 1, then the corresponding SK K = g(L) has 
the best rate Csk given by A similar approach is used to 
generate a PK of rate given by Q. 

The discussion above suggests that techniques for multiter- 
minal SW data compression could be used for the construction 
of SKs and PKs. Next, in SW coding, the existence of linear 
data compression codes with rates arbitrarily close to the SW 
bound has been long known [3]. In particular, when the i.i.d. 
sequences observed at the terminals are related to each other 
through virtual communication channels characterized by in- 
dependent additive noises, such linear data compression codes 
can be obtained in terms of the cosets of linear error-correction 
codes for these virtual channels, a fact first illustrated in [13] 
for the special case of d — 2 terminals connected by a virtual 
binary symmetric channel (BSC). This fact, exploited by most 
known linear constructions of SW codes (cf. e.g. [2], [7], [8], 
[11]), can enable us to translate these constructions and other 
significant recent developments in capacity-achieving linear 
codes into new SK and PK constructions. (See also recent 
independent work [10] for related existence results, as also 
[12].) 

Motivated by these considerations, we seek to devise new 
constructive schemes for secrecy generation. The main tech- 
nical contribution of this work is the following: we consider 
four simple models of secrecy generation and show how a 
new class of secret and private keys can be constructed, based 
on the SW data compression code from [13]. While we do 
not specify exactly the linear capacity-achieving channel codes 
used in the SW step of the procedure, these can be chosen - 
for instance - from the class of LDPC [8] and turbo codes [7] 
that have attracted wide attention. 

II. Preliminaries 

Consider a DMMS with d > 2 components, with corre- 
sponding generic rvs X%, ■ ■ ■ , Xd taking values in finite al- 
phabets Xi, ■ ■ ■ , Xd, respectively. Let Xj = (Xi i, ■ ■ ■ , Xi >n ), 
i G M. = {1, • • • , d}, be n i.i.d. repetitions of rv Xi. Terminals 
1, • • • , d, with respective observations Xi, • ■ • , X^, represent 
the d users who wish to generate a SK by public commu- 
nication. These terminals can communicate with each other 
through broadcasts over a noiseless public channel, possibly 
interactively in many rounds. In general, a transmission from 
a terminal is allowed to be any function of its observations, 



and of all previous transmissions. Let F denote collectively 
all the public transmissions. 

Given e > 0, the rv Kg represents an e-secret key (e-SK) 
for the terminals in M., achieved with communication F, if 
there exist rvs K{ = i*Q(Xj,F), i G M, with Ki and K s 
taking values in the same finite set JCs such that K$ satisfies 

• the common randomness condition 

Pr{Ki = K S , i G M) > 1 - e; 

• the secrecy condition 

-I{K S A F) < e; 

n 

• the uniformity condition 

-H(K S ) > - \og\IC s \-e. 
n n 

Let A C M be an arbitrary subset of terminals. The rv 
K-p(A) represents an e-private key (e-PK) for the terminals 
in A, private from the terminals in A c = M\A, achieved 
with communication F, if there exist rvs Ki — ifj(X,,F), 
i G A, with Ki and K-p(A) taking values in the same finite 
set K,-p(A) such that K-p(A) satisfies 

• the common randomness condition 

Pr(i<Q = K V (A), i G A) > 1 - e; 

• the secrecy condition 

^I(K V {A) A{Xi, zeA c },F)<e; 

• the uniformity condition 

-H(K V (A)) > - ]og\JCp(A)\-e. 
n n 

Definition 1 [5]: A nonnegative number R is called an 

(n) 

achievable SK rate if an e„-SK Kg is achievable with 
suitable communication (with the number of rounds possibly 
depending on n), such that e„ — > and -^H (k^j — > R. 
The largest achievable SK rate is called the SK-capacity, 
denoted by Csk- The PK-capacity for the terminals in A, 
denoted by Cpx{A), is similarly defined. An achievable SK 
rate (resp. PK rate) will be called strongly achievable if 
e„ above can be taken to vanish exponentially in n. The 
corresponding capacities are termed strong capacities. 

Single-letter characterizations have been provided for Csk 
in the case of d = 2 terminals in [9], [1] and for d > 2 
in [5]; and for Cpk{A) in case of d = 3 in [1] and 
for d > 3 in [5]. The proofs of the achievability parts 
exploit the close connection between secrecy generation and 
SW data compression. For instance, "common randomness," 
without any secrecy restrictions, is first generated through SW- 
compressed interterminal communication. This means that all 
the d terminals acquire a rv with probability = 1. In the next 
step, secrecy is then extracted from this common randomness 
by means of a suitable identical operation performed at each 
terminal on the acquired common randomness. When the 
common randomness first acquired by the d terminals is 



maximal, then the corresponding secret key has the best rate 
C S k given by Q. 

In this work, we consider four simple models for which 
we illustrate the construction of appropriate strong secret or 
private keys, which rely on suitable SW codes. The SW codes 
of interest will rely on the following result concerning the 
existence of "good" linear channel codes for a BSC. 

Hereafter, a BSC with crossover probability p, < p < i, 
will be denoted by BSC(p). Let hb(p) be the binary entropy 
function. 

Lemma 1 [6]: For each e > 0, < p < ^, and for all n 
sufficiently large, there exists a binary linear (n, n — m) code 
for the BSC(p), where m < n[ht,(p) + e], such that the average 
error probability of maximum likelihood decoding is less than 
2 _n17 , for some r\ > 0. 

III. Main Results 

MODEL 1: Let the terminals 1 and 2 observe, respectively, n 
i.i.d. repetitions of the correlated rvs X\ and X2, where X±, 
X2 are {0, \\-valued rvs with joint probability mass function 
(pmf) 

Px 1 x 2 {xi,x 2 ) = ^(1 -p)S XlX2 + ^p (1 - S XlX2 ), P<\, 

6) 

with 5 being the Kronecker delta function. These two terminals 
wish to generate a strong SK of maximal rate. 
The SK-capacity for this model is [9], [1], [5] 

C S k = I{Xi A X 2 ) = 1 - h b (p) bit/symbol. 

In the following, we show a simple scheme for both terminals 
to generate a SK with rate close to 1 — hb(p), which relies on 
Wyner's well-known method for SW data compression [13]. 
The SW problem of interest entails terminal 2 reconstructing 
the observed sequence x x at terminal 1 from the SW codeword 
for xi and its own observed sequence X2. 
(i) SW data compression [13]: Let C be the linear (n, n — m) 
code specified in Lemma 1 with parity check matrix P. Both 
terminals know C and P. 

Terminal 1 transmits the syndrome Px^ to terminal 2. The 
maximum likelihood estimate of Xi at terminal 2 is: 

x 2 (i)=x 2 e/ P (Px i 1 ePx t 2 ), 

where /p(Px* © Pxj) is the most likely n-sequence v with 
syndrome Pv* = Px.\ © Pxj, with © denoting addition 
modulo 2 and t denoting transposition. 

The probability of decoding error at terminal 2 is given by 

Pr(X 2 (l) ^ X x ) = Pr(X 2 © / P (PXf © PX|) ^ X x ). 

Under the given joint pmf (0, X 2 can be considered as an 
input to a virtual BSC(p), while Xi is the corresponding 
output, i.e., we can write 

X! =x 2 ©v, 



where V = (Vi, • • • , V n ) is an i.i.d. sequence of {0, l}-valued 
rvs, independent of X 2 , with Pr(X^ = 1) = p, 1 < i < n. It 
readily follows that 

Pr(X 2 (l) ^ XO = Pr(/ P (PV t ) ? V). 

Therefore, it follows from Lemma 1 that for some 77 > 0, 

Pr(X 2 (l) ^ Xi) < 2- n \ 

for all n sufficiently large. 

(ii) SK construction: Consider a (common) standard array for 
C known to both terminals. Denote by a^j the element of the 
i th row and the j th column in the standard array, 1 < i < 2 m , 
1 < j < 2"" m . 

Terminal 1 sets K\ = j\ if Xi equals sn ! j 1 in the standard 
array. Terminal 2 sets K2 = j 2 if X 2 (l) equals a.i,j 2 in the 
same standard array. 

(Hi) SK criteria: The following theorem shows that K\ con- 
stitutes a strongly achievable SK with rate approaching the 
SK-capacity. 

Theorem 1: The pair of rvs {K\, K2) generated above, with 
(common) range JC\ (say), satisfy 

Pr(Xi + K 2 ) < 2-""; 

IiK, A F) = 0; 

ff(jri) = iog|£i|. 

Further, 

-HiKx) >l-h b (p)-e. 
n 

Remark: The probability of K\ being different from K2 
exactly equals the average error probability of maximum 
likelihood decoding when C is used on a BSC(p). Furthermore, 
the gap between the rate of the generated SK and the SK- 
capacity is as wide as the gap between the rate of C and the 
channel capacity. Therefore, if a "better" channel code for 
a BSC(p), in the sense that the rate of this code is closer 
to the channel capacity and the average error probability of 
maximum likelihood decoding is smaller, is applied, then a 
"better" SK can be generated at both terminals, in the sense 
that the rate of this SK is closer to the SK-capacity and 
the probability is smaller that the keys generated at different 
terminals do not agree with each other. 

MODEL 2: Let the terminals 1 and 2 observe, respectively, n 
i.i.d. repetitions of the correlated rvs X\ and X2, where X\, 
X2 are {0, l}-valued rvs with joint pmf 

Px,x 2 M = (l-p)(l-q), 

Px 1 x 2 (0A) = pq, 

P Xl x 2 (l,0) = p(l-q), 
Px lX2 (l,l) = q(l-p), 

where p < i and < q < 1. These two terminals wish to 
generate a strong SK of maximal rate. 

Note that Model 1 is a special case of Model 2 for q= \. 
We show below a scheme for both terminals to generate a SK 



with rate close to the SK-capacity for this model [9], [1], [5], 
which is 

Csk = I{X\ A X 2 ) = h b (p + q - 2pq) - hb(p) bit /symbol. 

(i) SW data compression: This step is identical to step (i) for 
Model 1 . 

(ii) SK construction: Suppose that both terminals know the 
linear (n,n — m) code C specified in Lemma 1, and a 
(common) standard array for C. Let {e^ : 1 < i < 2 m } denote 
the set of coset leaders for all the cosets of C. Given a (generic) 
{0, l}-valued rv X, the set of sequences x e {0, 1}™ is called 
X-typical with constant £, denoted by T£ ^, if 

2 -n[H(x)+t] < p«( x ) < 2 -«[^(^)-«]. 

Denote by Ai the set of Tjj^ ^ -sequences in the coset of C 
with coset leader ej, 1 < i < 2 . If the number of sequences 
of the same type (cf. [4]) in A l is more than 2 n ^ I( - XlAX ^- e '^, 
where e' > £ + e, then collect arbitrarily 2™[ / ( XlAX2 )~ £ '] such 
sequences to compose a subset, which we call a regular subset 
(as it consists of sequences of the same type). Continue this 
procedure until the number of sequences of every type in Ai 
is less than 2 n ^ I( - XlAX2 ^ £ 'y Let N t denote the number of 
distinct regular subsets of Ai. 

Enumerate (in any way) the sequences in each regular 
subset. Let b ijjfc , where 1 < i < 2 m , 1 < j < N it 
1 < k < 2 n V (XlAX ^- £ '\ denote the k th sequence of the 
jth re g U j ar subset in the i th coset (i.e., the coset with coset 
leader ej). 

Terminal 1 sets K\ = k\ if Xi equals hij lt k 1 - 
Otherwise, K\ is set to be uniformly distributed on 
{l, ■ ■ ■ , 2 n ^^ AX ^-^Y and independent of (Xi,X 2 ). Ter- 
minal 2 sets K 2 = fc 2 if X 2 (l) equals b, ; j 2; fe 2 . Otherwise, K 2 
is set to be uniformly distributed on jl, • • • , 2 n ^ I( - XlAX2 ^ e '^ j, 
independent of (X l7 X 2 , Ki). 

(in) SK criteria: The following theorem shows that K\ con- 
stitutes a strongly achievable SK with rate approaching the 
SK-capacity. 

Theorem 2: For some v[ — r/'(r],^,s,e') > 0, the pair of 
rvs (Ki,K 2 ) generated above, with range /Q (say), satisfy 

Pr(#i ^K 2 ) < 2"""'; 

1(K X A F) - 0; 

F(^i) = log|/C 1 |. 

Further, 

—H{K\) = I(X\ A X 2 ) — e'. 

n 

MODEL 3: Let the terminals 1, ■ • • , d observe, respectively, n 
i.i.d. repetitions of {0, l}-valued rvs X\, ■ ■ ■ ,X^ which form 
a Markov chain 

Xi -o— X 2 -o- • • • -o- X d , 
with a joint pmf ' Px 1 - x d given by: for 1 < i < d — 1, 

PXiX i+1 ( x i> x i+l) = ^(i-Pi^aw+i + ^Pi (i-^XiXi+J, Pi < 



These d terminals wish to generate a strong SK of maximal 
rate. 

Note that Model 1 is a special case of Model 3 for d = 2. 
Without any loss of generality, let 



Then, the SK-capacity for this model is [5] 

Csk = A = 1 — hb{Pj) bit/symbol. 

We show below how to extract a SK with rate close to 
1 — hb{Pj) by using a SW data compression scheme for 
reconstructing Xj at all the terminals. 

(i) SW data compression: Let C be the linear (n,n — m) 
code specified in Lemma 1 for the BSC(pj), with parity check 
matrix P. Terminals i, 1 < i < d — 1, transmit the syndromes 
Px*, respectively. 

Let Xj(j') denote the maximum likelihood estimate at 
terminal i of Xj. For 1 < i < j — 1, terminal i, with 
the knowledge of (Px* +1 , • • • , Px*, Xj), forms the following 
successive maximum likelihood estimates 

Xi(* + 1) = x,®/ P (Px| ©Px* +1 ), 

*i(* + 2) = Xi (i + l)e/ P (Px* +1 ePx* +2 ), 

XiO') = ^(j-ljffi/ptPx^ePxp. 

For j + 1 < i < d, terminal i, with the knowledge of 
(Px*., • • • ,Px*_ l7 Xi), forms the following successive maxi- 
mum likelihood estimates 

Xj(l-l) = x l ©.fp(Px*©Px*_i), 
*i(i-2) - Ai(*-l)eA»(Pxt_ 1 ePxJ_ 2 ), 

Xi(j) = x,(j + l)©/p(Px* +1 ©Px*). 

It can be shown that for some r/ = t]'(r],d) > 0, 

Pr(XiO') = X,-, 1 < i+ j < d) > 1 - 2-""'. 

(z'z'J construction: Consider a (common) standard array for 
C known to all the terminals. Denote by the element of the 
I th row and the k th column in the standard array, 1 < I < 2 m , 
l<k< 2 n -"\ 

Terminal j sets Kj = kj if Xj equals a;^. in the standard 
array. Terminal i, 1 < i ^ j < d, sets Ki = ki if Xj(j) equals 
a^ki in the same standard array. 

(Hi) SK criteria: The following theorem shows that Kj con- 
stitutes a strongly achievable SK with rate approaching the 
SK-capacity. 

Theorem 3: The set of rvs {K\, • • • , K d ) generated above, 
with range tCj (say), satisfy 

Yi(K l = --- = K d ) > 1-2-™''; 

I(Kj AF) = 0; 

r H(K j ) = \og\KA. 



Further, 



1 



H(K j )>l-h b (p j )-e. 



MODEL 4: Let the terminals 1, 2 and 3 observe, respectively, 
n i.i.d. repetitions of the correlated rvs X\, X 2 , X 3 , where 
X\, X 2 , X 3 are {0, l}-valued rvs with joint pmf 



Px 1 x 2 x 3 (0, 0,0) = Px 1 x 2 x 3 {®, 1, 1) — 



(l-p)(l-«) 



pq 

Px 1 x 2 x 3 (0, 0, 1) = Px 1 x 2 x 3 {0, 1)0) = — , 
Px^x 2 x 3 (1,0,0) = Px 1 x 2 x 3 (l, 1, 1) = ~- 



Px 1 x 2 x 3 (l, 0, 1) — Px 1 x 2 x 3 0-, 1,0) — 



g(i-p) 



where p < i anc/ < 5 < 1. Terminals 1 and 2 wish to 
generate a strong PK of maximal rate, which is concealed 
from the helper terminal 3. 

Note that under the given joint pmf of X\, X 2 , X 3 , we can 
write 

Xi = X 2 © X 3 © V, 

where V = (Vi, • • • , V n ) is an i.i.d. sequence of {0, l}-valued 
rvs, independent of (X 2 ,X 3 ), with Pr(V^ = 1) = p, 1 < i < 
n. 

We show below a scheme for terminals 1 and 2 to generate 
a PK with rate close to the PK-capacity for this model [1], [5] 

CW({1,2}) = I(X 1 AX 2 \X 3 ) 

= h]){p + q — 2pq) — hb(p) bit /symbol. 

The preliminary step of this scheme entails terminal 3 simply 
revealing its observations X3 to both terminals 1 and 2. 
Then, Wyner's SW data compression scheme is used for 
reconstructing xi at terminal 2 from the SW codeword for 
xi and x 2 © x 3 . 

(i) SW data compression: This step is identical to step (i) for 
Model 1. 

(H) PK construction: Suppose that terminals 1 and 2 know 
the linear (n, n — m) code C specified in Lemma 1, and a 
(common) standard array for C. Let {e^ : 1 < i < 2 m } denote 
the set of coset leaders for all the cosets of C. Given (generic) 
{0, l}-valued rvs X, Y, the set of pairs of sequences (x, y) G 
{0, 1}™ x {0, 1}" is called XY -typical with constant £, denoted 
by T% Y V if x e v y G T£ £ , and 

2 -n[H(X,Y) +i ] < p« y ( Xj y) < 2 -n[H(X,Y)-i] ^ 

For every y G {0, 1}", the set of sequences x G {0, 1}™ is 
called X\Y -typical with respect to y with constant £, denoted 
^ T x\Y./y\ if ( x >y) e T xy, V Note that Tj^(y) is an 
empty set if y ^ Ty ^. 

For a sequence x 3 G {0, 1}™, denote by A^(x 3 ) the set of 
r ^x 1 \x 3 ^(x 3 )-sequences in the coset of C with coset leader ej, 
1 < i < 2 m . If the number of sequences of the same joint type 
(cf. [4]) with x 3 in A 4 (x 3 ) is more than 2 n ^ I(XlAX ^ x ^- E '\ 
where e' > 2£ + e, then collect arbitrarily 2™[ / ( XlAX2 l X3 )- £ '] 
such sequences to compose a regular subset. Continue this 



procedure until the number of sequences of every joint type 
with x 3 in A,(x 3 ) is less than 2 n ^ I(XlAX ^ x ^- e '\ Let ^(x 3 ) 
denote the number of distinct regular subsets of Ai(x 3 ). 

For a given sequence x 3 , enumerate (in any way) the 
sequences in each regular subset. Let bi ) j ) fe(x3), where 1 < 
i < 2 m , 1 < j < Ni(x 3 ), l<k< 2™[ / ( x i AX 2|x 3 )- £ '] 5 denote 
the k th sequence of the j th regular subset in the i th coset. 

Terminal 1 sets K\ = k\ if Xi equals b i j 1 ^ 1 0i~3)- 
Otherwise, K\ is set to be uniformly distributed on 
{ 1) ... )2 n[^iAX 2 |x 3 )- e ']-}. ) independent of (Xi,X 2 ,X 3 ). 

Terminal 2 sets K 2 = k 2 if X 2 (l) equals hij 2 ^ 2 (X 3 ). 
Otherwise, K 2 is set to be uniformly distributed 
on {1,- • • 7 2^^ XlAX2 ^-^}, independent of 
(Xi.Xa.Xa.Jfi). 

(Hi) SK criteria: The following theorem shows that Ki con- 
stitutes a strongly achievable PK with rate approaching the 
PK-capacity. 

Theorem 4: For some 77' = r]'(r],^,s,s') > 0, the pair of 
rvs (Ki,K 2 ) generated above, with range /Ci (say), satisfy 

Pr(^ ^K 2 ) < 2-™"'; 

/(^AX 3 ,F) = 0; 

H(K 1 ) = \og\K 1 \. 



Further, 



n 



-H(K 1 )=I(X 1 AX 2 \X 3 )-e'. 
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